fix(cli-bridge): state which call can add a turn after reconstruction

[drewstone]

Why

Both issues were largely shipped in 0.9.0–0.9.2. What was left is honesty about what a reconstructed environment can do, plus the interaction acknowledgements no test had ever produced against a real bridge.

• fix(cli-bridge): support restart-safe native continuation #216: Pi restart-safe continuation already works — session.continueNative (src/retained-environment.ts:484-514 → POST /v1/sessions/:id/continue), proven live at tests/cli-bridge.integration.test.ts:307-620. The README still promised that session.prompt continues a conversation after provider.get(), which it never does.
• feat(agent-provider-cli-bridge): consume the bridge server's durable interaction-response operation and advertise interactions #204: (a) respondToInteraction (src/interaction-response.ts:109-171), (b) interactions derived from GET /v1/capabilities (src/capability-discovery.ts:116-120), (c) canonical interaction events with binding (src/retained-canonical-event.ts:17-69) all shipped. Only (d) was open: three acknowledgement statuses no contract test had produced.

What

• README "Which call adds a turn": the two-tier rule. In-process, dispatch/stream/prompt add a turn; after provider.get() only session.continueNative does, and only with the nativeContinuation capability (Pi today). Names why a runtime caller uses RetainedRunHandle.continueNative and not startRetainedRunInEnvironment (that path needs provider.list, which this provider does not expose, and then calls dispatch, which a reconstructed environment refuses). Generic-harness continuation stays blocked on Bridge-side native sessions (drewstone/cli-bridge).
• One refusal replaces three: stream, dispatch, and session.prompt had three separately-worded errors for one rule. They now route through assertCliBridgeTurnAllowed, whose message names the surface, the one call that works (session.continueNative), and the capability it needs.
• feat(agent-provider-cli-bridge): consume the bridge server's durable interaction-response operation and advertise interactions #204(d) live scenarios in tests/cli-bridge.integration.test.ts: after accepted, a new operationId with a different answer → already_resolved_different (409); a new operationId with the same answer → already_resolved_same (200); a third run cancelled while its permission is outstanding, then answered → cancelled (409).
• Unit contradiction table gains [409, already_resolved_different], [409, cancelled], [409, expired].

Capability honesty: the requested narrowing is not expressible, and the test pins why

The plan was to publish sessions.continue: false on a reconstructed non-Pi environment while keeping retainedControl. That document is invalid. AgentEnvironmentCapabilitiesSchema (agent-interface src/environment-runtime.ts:522-532) refuses it with:

retained control requires exact run, result, event, cancellation, replay, detach, turn, and session identity together

Measured directly against defaultCliBridgeCapabilities("codex") with sessions.continue flipped to false: safeParse → success: false, that one issue. Dropping retainedControl instead would remove replay, result, and cancellation from every reconstructed environment — the only reason get() exists — so it is a regression, not honesty.

nativeContinuation is the flag that already carries this answer: present ⇒ continueNative adds a turn; absent ⇒ no call on that environment adds one. The new test asserts that per harness AND asserts the narrowed document fails validation, so nobody "fixes" the document into an invalid state later.

Proof

• pnpm build: 10 packages Done. pnpm check-types: 0 errors.
• pnpm test: cli-bridge 204 passed (was 199); workspace 1524 passed, 0 failed.
• pnpm check:package-artifacts: 9 packages, 31 exports, 62 export targets. pnpm check:control-artifacts: 7 files, 141 tests.
• Integration test cannot run on macOS — the pinned Bridge (33b2b40) refuses the Pi backend without an enforced Linux fs-jail: backend pi requires an enforced Linux fs-jail ... enable bubblewrap. The three new scenarios are verified by the CLI Bridge integration job in this PR's CI, which is the environment that has bubblewrap. Server behavior was read at the pinned commit before writing them: src/sessions/retained/interactions.ts:279-290 (resolved-digest compare → same/different), :284 + src/runs/run.ts:353-364 (cancel() → cancelOutstandingInteractions → cancelled), statusForAcknowledgement → 409/200.
• expired is not producible live: the pinned Bridge maps the status but never emits it (interactions.ts:514 is the only occurrence). It stays unit-covered only, and the README says so.

Simplification: three separately-worded refusals for one rule collapsed into assertCliBridgeTurnAllowed; the refusal now names the call that works instead of only the call that does not.
Net: +208 / -13 lines, 6 files, 3 refusal copies → 1.
Tests: +5 (2: a reconstructed codex/pi environment publishes which call adds a turn and refuses the three that do not, and the narrowed capability document is proven invalid; 3: unit rows for already_resolved_different/cancelled/expired HTTP-status agreement) and +3 live acknowledgement scenarios that pin the wire contract with the Bridge server across two repos, -0 deleted.
Not done here: generic-harness native sessions in the Bridge server, the only real closure of #216 beyond Pi; it is server-side work in drewstone/cli-bridge.

Closes #216
Closes #204

[tangletools]

✅ Auto-approved drewstone PR — 9858aaab

This PR was opened by the trusted drewstone account.

This approval is provisional and was applied by the local stand-in because the pr-reviewer webhook host is unreachable (2026-08-21). CI on this head is fully green. The full PR reviewer audit re-runs via the resweep when the service returns and will publish findings if it detects issues.